From e8a11013cbf407e9bca4c8951e1c62d392755fab Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Fri, 27 Sep 2024 09:56:02 +0200 Subject: [PATCH] Update 20240927070216 (#612) feat: Updated at 20240927070216 Signed-off-by: bitnami-bot --- data/gitlab/BIT-gitlab-2024-4278.json | 72 ++++++++++++++++ .../mattermost/BIT-mattermost-2024-45843.json | 50 +++++++++++ .../mattermost/BIT-mattermost-2024-47003.json | 83 +++++++++++++++++++ .../mattermost/BIT-mattermost-2024-47145.json | 50 +++++++++++ 4 files changed, 255 insertions(+) create mode 100644 data/gitlab/BIT-gitlab-2024-4278.json create mode 100644 data/mattermost/BIT-mattermost-2024-45843.json create mode 100644 data/mattermost/BIT-mattermost-2024-47003.json create mode 100644 data/mattermost/BIT-mattermost-2024-47145.json diff --git a/data/gitlab/BIT-gitlab-2024-4278.json b/data/gitlab/BIT-gitlab-2024-4278.json new file mode 100644 index 000000000..cdbf614d0 --- /dev/null +++ b/data/gitlab/BIT-gitlab-2024-4278.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-gitlab-2024-4278", + "details": "An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.", + "aliases": [ + "CVE-2024-4278" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "16.5.0" + }, + { + "fixed": "17.2.8" + }, + { + "introduced": "17.3.0" + }, + { + "fixed": "17.3.4" + } + ] + }, + { + "type": "SEMVER", + "events": [ + { + "introduced": "17.4.0" + }, + { + "last_affected": "17.4.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", + "cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458484" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/2466205" + } + ], + "published": "2024-09-27T07:24:05.639Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-45843.json b/data/mattermost/BIT-mattermost-2024-45843.json new file mode 100644 index 000000000..b0c0cdeaa --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-45843.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-45843", + "details": "Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.", + "aliases": [ + "CVE-2024-45843" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2024-09-27T07:20:06.325Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-47003.json b/data/mattermost/BIT-mattermost-2024-47003.json new file mode 100644 index 000000000..d3ccd79ce --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-47003.json @@ -0,0 +1,83 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-47003", + "details": "Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.", + "aliases": [ + "CVE-2024-47003" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.9" + } + ] + }, + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.11.0" + }, + { + "last_affected": "9.11.0" + }, + { + "introduced": "9.11.0-rc1" + }, + { + "last_affected": "9.11.0-rc1" + }, + { + "introduced": "9.11.0-rc2" + }, + { + "last_affected": "9.11.0-rc2" + }, + { + "introduced": "9.11.0-rc3" + }, + { + "last_affected": "9.11.0-rc3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:-:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc1:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc2:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc3:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2024-09-27T07:19:54.937Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-47145.json b/data/mattermost/BIT-mattermost-2024-47145.json new file mode 100644 index 000000000..afc13e3d0 --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-47145.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-47145", + "details": "Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.", + "aliases": [ + "CVE-2024-47145" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2024-09-27T07:19:43.531Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file